Vulnerability identifier: #VU23653

Vulnerability risk: Medium

CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-17336

CWE-ID: CWE-200

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
TIBCO Spotfire Server
Server applications / Other server solutions
TIBCO Spotfire for AWS
Server applications / Other server solutions

Vendor: TIBCO

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the Data access layer component exposes credentials for shared data sources. A remote authenticated attacker can gain access to information that can lead to obtaining credentials used to access Spotfire data sources.

To successful exploitation of this vulnerability the attacker would need privileges to save a Spotfire file to the library, and only applies in a situation where NTLM credentials, or a credentials profile is in use.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

TIBCO Spotfire Server: 7.0.0 - 10.6.0

TIBCO Spotfire for AWS: 10.6.0

---

External links
http://www.tibco.com/services/support/advisories
http://www.tibco.com/support/advisories/2019/12/tibco-security-advisory-december-17-2019-tibco-spotfire-2019-17336

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.